Rently Smart Home versions 20.1.0 and earlier contain a high-severity vulnerability that could let an attacker retrieve access PINs, including the Master PIN, and override standard user permissions. The Cybersecurity and Infrastructure Security Agency disclosed the issue on August 25 under CVE-2026-75960.
The vulnerability is classified as insufficiently protected credentials, or CWE-522. CISA said successful exploitation could allow an attacker to access sensitive information and override user permissions. The advisory identifies Rently Smart Home as a known-affected product and lists deployments in the United States and India. It also associates the product with the commercial facilities, communications, and information technology sectors.
The flaw affects Rently Smart Home versions 20.1.0 and prior. According to the advisory, an attacker could retrieve stored PINs, including the Master PIN. Access to that credential could allow the attacker to bypass standard user permissions within the product. The advisory does not identify a separate vulnerability affecting other Rently products.
CISA assigned the issue a CVSS 3.1 base score of 8.1, rated high. Under that scoring system, exploitation can occur over a network, requires low attack complexity and limited privileges, and does not require user interaction. The assessment rates the potential impact as high for confidentiality and integrity, while availability is not affected.
The advisory also gives the vulnerability a CVSS 4.0 base score of 8.7, again rated high. That framework rates the potential impact as high for vulnerability confidentiality, integrity and availability. It records no additional impact on subsequent systems. The two scores are assessments under different versions of the Common Vulnerability Scoring System and do not represent separate flaws.
Rently patched the vulnerability in late June, before CISA published its advisory. CISA states that no user action is required. The agency credits Berk Dusunur with reporting the issue.
CISA said no known public exploitation specifically targeting CVE-2026-75960 had been reported when the advisory was published. That statement concerns publicly known exploitation of this vulnerability and does not change the risk associated with the credential exposure and permission override described in the advisory.
For organizations using or managing the affected product, CISA recommends minimizing network exposure for control-system devices and systems and ensuring they are not accessible directly from the internet. It advises placing control-system networks and remote devices behind firewalls and isolating them from business networks.
When remote access is required, CISA recommends more secure methods such as virtual private networks. The agency cautions that VPNs can have vulnerabilities and should be updated to the latest available versions. It also notes that a VPN is only as secure as the devices connected to it.
CISA advises organizations to conduct impact analysis and risk assessments before deploying defensive measures. Organizations that observe suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation. The agency separately advises users to avoid links and attachments in unsolicited email messages as protection against social engineering and phishing attacks.